Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Ending support for RC4 cipher in Microsoft Edge and Internet Explorer

Today, Microsoft is announcing the end-of-support of the RC4 cipher in Microsoft Edge and Internet Explorer 11. Starting in early 2016, the RC4 cipher will be disabled by-default and will not be used during TLS fallback negotiations.

There is consensus across the industry that RC4 is no longer cryptographically secure. Our announcement aligns with today’s announcements from Google and Mozilla, who are ending support for RC4 in Chrome and Firefox.

What is RC4?

RC4 is a stream cipher that was first described in 1987, and has been widely supported across web browsers and online services. Modern attacks have demonstrated that RC4 can be broken within hours or days. The typical attacks on RC4 exploit biases in the RC4 keystream to recover repeatedly encrypted plaintexts. In February 2015, these new attacks prompted the Internet Engineering Task Force to prohibit the use of RC4 with TLS.

Microsoft Edge and Internet Explorer 11 only utilize RC4 during a fallback from TLS 1.2 or 1.1 to TLS 1.0. A fallback to TLS 1.0 with RC4 is most often the result of an innocent error, but this is indistinguishable from a man-in-the-middle attack. For this reason, RC4 will be entirely disabled by default for all Microsoft Edge and Internet Explorer users on Windows 7, Windows 8.1 and Windows 10 starting in early 2016.

How can I prepare?

We expect that most users will not notice this change. The percentage of insecure web services that support only RC4 is known to be small and shrinking.

If your web service relies on RC4, you will need to take action. Since 2013, Microsoft has recommended that customers enable TLS 1.2 in their services and remove support for RC4. For additional details, please see Security Advisory 2868725.

Does this means IE11 will get a patch for this?
I'll wait for the KB in that case...

Well I hardly ever use IE11 (installed on my machine) so it's difficult to comment. Personally my view is that it might be better to disable TLS 1.0 and only re-enable it on as as an when needed basis.

Now here's an interesting result using Cyberfox (Firefox variant)

Configured insecurely the RC4 cipher is indeed used during TLS fallback negotiations:

However if configured properly that doesn't happen and it doesn't use RC4 cipher suite:

EDIT:

Some more info here that doesn't seem to tie in with the announcement:

Yes I did the same - disabled all RC4 ciphers via registry but that only seems to work with Winows and IE. It doesn't seem to affect other browsers specifically Firefox. In my case I use Cyberfox, FF Portable and Opera 12 mostly.

In my earlier posts I was just testing sites that use that insecure fallback method (utilizing RC4 during a fallback from TLS 1.2 or 1.1 to TLS 1.0.)

Support for WINDOWS XP ending April 2014When support for XP ends this April, I can understand that no further Security/Enhancement updates will be coming down the pipe. My question is this - If I have to reload my Windows XP SP1 system, will updates prior to April 2014 still be available to download & install. IE: Sp2, Sp3 etc.
Or does...